1

For instance, I have the rule

#iptables -A OUTPUT -d www.google.com -j ACCEPT

When I type this rule in a terminal it resolves to the appropriate IPs, and that is what is stored in rules.v4 when I save. Is there a way to have www.google.com stored in the file that gets automatically loaded instead of the IPs? I have tried editing the file directly, but when I put a name in there, the rules just fail to load.

  • have you tried the -d www.google.com ? – cutzero Mar 5 '16 at 8:20
  • Sorry, I did have -d in my command, left that out (updated question) – scott.se Mar 5 '16 at 13:59
1

No. The kernel doesn't know anything about names. The in-kernel rules have IP addresses only. Saving and restoring those rules with iptables-save and iptables-restore uses a textual format that is a reversible exact representation of what's in the kernel and therefore also doesn't deal in names.

The closest thing you can do to what you want is probably to save your rules in the form of a shell script which you maintain manually and contains a sequence of iptables and ip6tables commands that set up your rules which can contain names. But read on to know why you probably shouldn't.

You should carefully consider the reason why you need to use names in the first place. Are you using a name because you do not know in advance what IP address the name will point to or because the IP address which the name maps to may change from time to time? Consider that when you use a name, the iptables or ip6tables command resolves the name then and there and what then lives inside the kernel indefinitely is an IP address. What happens when the mapping between a name and IP address changes? DNS names have TTLs which express how long you are supposed to cache the mapping between the name the the address. But in-kernel iptables rules won't get updated when the mapping changes, leading to rules with stale/obsolete IP addresses in them.

  • Thank you, but I fail to see why the third paragraph is a reason to not want to use names? Stale mappings is exactly what I'm trying to avoid, so when I commit the current state, my permanent rules will forever be tied to what the IPs of a name were at the time I committed?? – scott.se Mar 5 '16 at 17:59
  • Sorry if I wasn't clear. My main point about that paragraph was that your in-kernel rules are already tied to a specific IP address so an obsolete IP address may remain in-kernel for months or years unless you reboot or reprogram the rules from userspace on a regular basis. In other words, the failure of iptables-save to preserve the names is not your most important problem. – Celada Mar 5 '16 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.